svchost.exe?

[DarkAlex]

Sorry if I seem to have a lot of promblems but I need help again. Occasionally when my computer's running, the CPU usage skyrockets and the culprit is one of many processes named svchost.exe. If i terminate the errant process, any program that plays sound cannot unless it was running prior to shutting svchost.exe down. Is this a virus? And if so, is there a way to get rid of it? Norton Antivirus 2007 doesn't notice if it is a virus/trojan. Please help!

[Elysia]

svchost.exe is a Windows (Network) Service.
If the CPU skyrockets, I'm thinking it has something to do with some program abusing something. You could always take a look at what exactly it's doing with Process Monitor.
You could also scan the system using NOD32 (best AV on the market).

[DarkAlex]

Process Monitor? What's that? Also, why would shutting down one of the svchosts shut down the sound card for processes started after svchost's manual terination with Task Manager?

[Elysia]

Don't know why it would happen, but Process Monitor:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

[NeonBlack]

I'm having the same problem with one of my laptops. I am still looking for a permanent solution.
Search microsoft.com and manually download the hotfix updates. If that still doesn't help, disable automatic updates. Just remember to check for updates every few weeks.

[Elysia]

Or just installing none of them. I've found that installing hotfixes needlessly will only break your system. Far better to wait for a Service Pack instead.

[NeonBlack]

So how long do we have to wait for SP3?

[Elysia]

Aprilish I think. But there's no saying it needs a hotfix. I've never had that problem and I'm just running SP2 with (almost) no hotfixes at all, and certainly no svchost fix.

[NeonBlack]

Most people will have no problem with it. I have no idea what causes the problem (and the way it sounds, neither does microsoft). But basically what happens is in addition to a svchost.exe using 100+ mb of memory and 99% cpu for long periods of time, the automatic updates will not work and neither will the "windows update" or "microsoft update" from microsoft.com. Apparently, the hotfix works for some people, so I say you might as well give it a shot, or else (like me) you're going to have to look at that annoying little red shield until we get SP3.
I feel extra-bad for Alex since he also uses Norton, which can bring even the fastest PC's to a crawl.

edit: to alex: You can check and if svchost.exe is running from the system32 directory, then it's definitely not a virus. However, what you describe (losing sound and probably other things when you kill it) sounds normal. svchost (there might be 4-6 of them running at any given time) along with explorer.exe and a few others essentially ARE Windows, so don't kill them. The last I heard, Microsoft has acknowledged this problem, but not much else, so at worst, you will have to turn off automatic updates for awhile. Hopefully, it will be fixed in SP3 though.

[Elysia]

Yes, scrap Norton.
Individual hotfixes can be downloaded and installed with, hopefully at least, most times, no problem. But downloading all hotfixes will invite trouble. But the question is, which hotfix is the right one?

[NeonBlack]

let's see.... it was
KB927891

[DarkAlex]

It hasn't given me a problem since I rebooted my comp yesterday after losing sound. After the reboot, an error message box popped up and said that svchost.exe tried to reference memory at 0x000000 and Windows shut the process down. I'm assuming that this was the errant svchost.exe, and I haven't lost sound. I think the losing sound problem only occurs if I use Task Manager to kill the process. I also did an Explorer search of my computer and found one svchost in the system32 folder, one in a compressed folder called $NtServicePackUninstall$, and one in ServicePackFiles\i386. All of these folders are subfolders of C:\WINDOWS, so I don't think it's a virus. Any ideas about what's wrong?

[maxorator]

Aprilish I think. But there's no saying it needs a hotfix. I've never had that problem and I'm just running SP2 with (almost) no hotfixes at all, and certainly no svchost fix.
That's why your Windows is throwing a tantrum. :D

Svchost isn't probably the cause, since it only "hosts" services. Basically svchost provides some common interface for the services, where the service itself is just a DLL loaded into svchost. So you should check what's the actual service behind this.

[Elysia]

That's why your Windows is throwing a tantrum. :D

That's why it isn't throwing a tantrum. Applying updates just causes blue screens or erratic behavior. Every time.

[maxorator]

That's why it isn't throwing a tantrum. Applying updates just causes blue screens or erratic behavior. Every time.
I wonder why it only does that for you...

Anyway, I check updates like once in two months but then I install them all. :)

[Elysia]

I wonder why it only does that for you...

If I knew that, I'd be a genius :D
The only guaranteed stable way is to slipstream the pack into the installation and install. Installing a service pack can sometimes be risky, too, but far less so than installing all fixes manually.

[maxorator]

Check the box of your XP to see if it isn't the "Windows XP Annoying Edition". :D

I have to admit I have had no problems installing patches and fixes.

[DarkAlex]

No, my Windows is 'Home Edition', and is upgraded to SP2. Also, I haven't seen the 'Windows Update' dialog box since upgrading my comp initially to SP2. I think the progs giving me a problem only act up if I manually kill the errant instance of svchost.exe, since Windows killed it for referencing memory at 0x000000 (or however many zeros it is), and I haven't had any problems since.

[vart]

my Windows is 'Home Edition'
It is just a synonim

[DarkAlex]

Actually help with my problem if you post, ok?

[vart]

Actually help with my problem if you post, ok?

The only help I can give - an advice - change your OS to something serious... XP Pro for example

[DarkAlex]

Ok, update: At the time of this post, svchost.exe has yet again eaten my CPU usage. The owner of the process is 'SYSTEM'. Shutting it down... Again, sound is gone. I thought Windows had killed the rouge process. Any help now?

EDIT: 11:58 AM
----------------------------
I rebooted and Windows displayed a message box that said "Data Excecution Prevention" and shut down a rouge instance of svchost.exe. I haven't lost sound yet.

[Neo1]

The only help I can give - an advice - change your OS to something serious... XP Pro for example

What difference between Home and Pro Edition is it that makes XP Pro more serious :S?

[DarkAlex]

Oi! No go on side topics! XP Pro has better security features than XP Home. That's it! Now posters please help!

[lightatdawn]

You have bad drivers for something or a virus. Thats basically all it could be.

[DarkAlex]

Please elaborate and tell me how to fix. Remember, I have Norton Antivirus 2007 and it doesn't detect anything.

[NeonBlack]

Norton, as the name implies, gets rid of VIRUSES. There is absolutely nothing it can do about BUGS in the operating system.
Try the hotfix. If that doesn't work, turn off automatic updates until SP3 comes out.

(Actually, there is already a pre-release of SP3 available, but I don't recommend downloading it until the release version is made available.)

[lightatdawn]

The standard first try for something like this is to update everything. Make sure all your drivers are new, especially the sound ones in your case. Run Windows Update and get whatevers available.

Try an online virus scanner just in case. It's easy and costs you nothing. BitDefender (http://www.bitdefender.com/scan8/ie.html) pops to mind but there are a few others. It's always nice to rule out the simplest answers first.

Failing those I'd try SpyBot Search & Destroy and failing any of that easy stuff, your into some real diagnostics.

[Elysia]

Please elaborate and tell me how to fix. Remember, I have Norton Antivirus 2007 and it doesn't detect anything.

Norton is a very poor AV software. You can try NOD32, the best one of the market, for free in 30 days. It gets rid of most viruses. But there's no telling it might be a virus. Scanning for spyware using Spybot might also help, as they say.
Otherwise a google search for svchost.exe 100% might help?